1 /* Copyright 2008 IBM Corporation
3 * Copyright 2011 Intel Corporation
4 * Copyright 2016 Veertu, Inc.
5 * Copyright 2017 The Android Open Source Project
7 * QEMU Hypervisor.framework support
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of version 2 of the GNU General Public
11 * License as published by the Free Software Foundation.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 * This file contain code under public domain from the hvdos project:
22 * https://github.com/mist64/hvdos
24 * Parts Copyright (c) 2011 NetApp, Inc.
25 * All rights reserved.
27 * Redistribution and use in source and binary forms, with or without
28 * modification, are permitted provided that the following conditions
30 * 1. Redistributions of source code must retain the above copyright
31 * notice, this list of conditions and the following disclaimer.
32 * 2. Redistributions in binary form must reproduce the above copyright
33 * notice, this list of conditions and the following disclaimer in the
34 * documentation and/or other materials provided with the distribution.
36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
49 #include "qemu/osdep.h"
50 #include "qemu-common.h"
51 #include "qemu/error-report.h"
53 #include "sysemu/hvf.h"
54 #include "sysemu/hvf_int.h"
55 #include "sysemu/runstate.h"
60 #include "x86_descr.h"
62 #include "x86_decode.h"
67 #include <Hypervisor/hv.h>
68 #include <Hypervisor/hv_vmx.h>
69 #include <sys/sysctl.h>
71 #include "hw/i386/apic_internal.h"
72 #include "qemu/main-loop.h"
73 #include "qemu/accel.h"
74 #include "target/i386/cpu.h"
76 void vmx_update_tpr(CPUState
*cpu
)
78 /* TODO: need integrate APIC handling */
79 X86CPU
*x86_cpu
= X86_CPU(cpu
);
80 int tpr
= cpu_get_apic_tpr(x86_cpu
->apic_state
) << 4;
81 int irr
= apic_get_highest_priority_irr(x86_cpu
->apic_state
);
83 wreg(cpu
->hvf_fd
, HV_X86_TPR
, tpr
);
85 wvmcs(cpu
->hvf_fd
, VMCS_TPR_THRESHOLD
, 0);
87 wvmcs(cpu
->hvf_fd
, VMCS_TPR_THRESHOLD
, (irr
> tpr
) ? tpr
>> 4 :
92 static void update_apic_tpr(CPUState
*cpu
)
94 X86CPU
*x86_cpu
= X86_CPU(cpu
);
95 int tpr
= rreg(cpu
->hvf_fd
, HV_X86_TPR
) >> 4;
96 cpu_set_apic_tpr(x86_cpu
->apic_state
, tpr
);
99 #define VECTORING_INFO_VECTOR_MASK 0xff
101 void hvf_handle_io(CPUArchState
*env
, uint16_t port
, void *buffer
,
102 int direction
, int size
, int count
)
105 uint8_t *ptr
= buffer
;
107 for (i
= 0; i
< count
; i
++) {
108 address_space_rw(&address_space_io
, port
, MEMTXATTRS_UNSPECIFIED
,
115 static bool ept_emulation_fault(hvf_slot
*slot
, uint64_t gpa
, uint64_t ept_qual
)
119 /* EPT fault on an instruction fetch doesn't make sense here */
120 if (ept_qual
& EPT_VIOLATION_INST_FETCH
) {
124 /* EPT fault must be a read fault or a write fault */
125 read
= ept_qual
& EPT_VIOLATION_DATA_READ
? 1 : 0;
126 write
= ept_qual
& EPT_VIOLATION_DATA_WRITE
? 1 : 0;
127 if ((read
| write
) == 0) {
132 if (slot
->flags
& HVF_SLOT_LOG
) {
133 memory_region_set_dirty(slot
->region
, gpa
- slot
->start
, 1);
134 hv_vm_protect((hv_gpaddr_t
)slot
->start
, (size_t)slot
->size
,
135 HV_MEMORY_READ
| HV_MEMORY_WRITE
);
140 * The EPT violation must have been caused by accessing a
141 * guest-physical address that is a translation of a guest-linear
144 if ((ept_qual
& EPT_VIOLATION_GLA_VALID
) == 0 ||
145 (ept_qual
& EPT_VIOLATION_XLAT_VALID
) == 0) {
152 if (!memory_region_is_ram(slot
->region
) &&
153 !(read
&& memory_region_is_romd(slot
->region
))) {
159 void hvf_arch_vcpu_destroy(CPUState
*cpu
)
161 X86CPU
*x86_cpu
= X86_CPU(cpu
);
162 CPUX86State
*env
= &x86_cpu
->env
;
164 g_free(env
->hvf_mmio_buf
);
167 static void init_tsc_freq(CPUX86State
*env
)
172 if (env
->tsc_khz
!= 0) {
176 length
= sizeof(uint64_t);
177 if (sysctlbyname("machdep.tsc.frequency", &tsc_freq
, &length
, NULL
, 0)) {
180 env
->tsc_khz
= tsc_freq
/ 1000; /* Hz to KHz */
183 static void init_apic_bus_freq(CPUX86State
*env
)
188 if (env
->apic_bus_freq
!= 0) {
192 length
= sizeof(uint64_t);
193 if (sysctlbyname("hw.busfrequency", &bus_freq
, &length
, NULL
, 0)) {
196 env
->apic_bus_freq
= bus_freq
;
199 static inline bool tsc_is_known(CPUX86State
*env
)
201 return env
->tsc_khz
!= 0;
204 static inline bool apic_bus_freq_is_known(CPUX86State
*env
)
206 return env
->apic_bus_freq
!= 0;
209 int hvf_arch_init_vcpu(CPUState
*cpu
)
211 X86CPU
*x86cpu
= X86_CPU(cpu
);
212 CPUX86State
*env
= &x86cpu
->env
;
217 hvf_state
->hvf_caps
= g_new0(struct hvf_vcpu_caps
, 1);
218 env
->hvf_mmio_buf
= g_new(char, 4096);
220 if (x86cpu
->vmware_cpuid_freq
) {
222 init_apic_bus_freq(env
);
224 if (!tsc_is_known(env
) || !apic_bus_freq_is_known(env
)) {
225 error_report("vmware-cpuid-freq: feature couldn't be enabled");
229 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED
,
230 &hvf_state
->hvf_caps
->vmx_cap_pinbased
)) {
233 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED
,
234 &hvf_state
->hvf_caps
->vmx_cap_procbased
)) {
237 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2
,
238 &hvf_state
->hvf_caps
->vmx_cap_procbased2
)) {
241 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY
,
242 &hvf_state
->hvf_caps
->vmx_cap_entry
)) {
246 /* set VMCS control fields */
247 wvmcs(cpu
->hvf_fd
, VMCS_PIN_BASED_CTLS
,
248 cap2ctrl(hvf_state
->hvf_caps
->vmx_cap_pinbased
,
249 VMCS_PIN_BASED_CTLS_EXTINT
|
250 VMCS_PIN_BASED_CTLS_NMI
|
251 VMCS_PIN_BASED_CTLS_VNMI
));
252 wvmcs(cpu
->hvf_fd
, VMCS_PRI_PROC_BASED_CTLS
,
253 cap2ctrl(hvf_state
->hvf_caps
->vmx_cap_procbased
,
254 VMCS_PRI_PROC_BASED_CTLS_HLT
|
255 VMCS_PRI_PROC_BASED_CTLS_MWAIT
|
256 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET
|
257 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW
) |
258 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL
);
259 wvmcs(cpu
->hvf_fd
, VMCS_SEC_PROC_BASED_CTLS
,
260 cap2ctrl(hvf_state
->hvf_caps
->vmx_cap_procbased2
,
261 VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES
));
263 wvmcs(cpu
->hvf_fd
, VMCS_ENTRY_CTLS
, cap2ctrl(hvf_state
->hvf_caps
->vmx_cap_entry
,
265 wvmcs(cpu
->hvf_fd
, VMCS_EXCEPTION_BITMAP
, 0); /* Double fault */
267 wvmcs(cpu
->hvf_fd
, VMCS_TPR_THRESHOLD
, 0);
269 x86cpu
= X86_CPU(cpu
);
270 x86cpu
->env
.xsave_buf
= qemu_memalign(4096, 4096);
272 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_STAR
, 1);
273 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_LSTAR
, 1);
274 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_CSTAR
, 1);
275 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_FMASK
, 1);
276 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_FSBASE
, 1);
277 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_GSBASE
, 1);
278 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_KERNELGSBASE
, 1);
279 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_TSC_AUX
, 1);
280 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_IA32_TSC
, 1);
281 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_IA32_SYSENTER_CS
, 1);
282 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_IA32_SYSENTER_EIP
, 1);
283 hv_vcpu_enable_native_msr(cpu
->hvf_fd
, MSR_IA32_SYSENTER_ESP
, 1);
288 static void hvf_store_events(CPUState
*cpu
, uint32_t ins_len
, uint64_t idtvec_info
)
290 X86CPU
*x86_cpu
= X86_CPU(cpu
);
291 CPUX86State
*env
= &x86_cpu
->env
;
293 env
->exception_nr
= -1;
294 env
->exception_pending
= 0;
295 env
->exception_injected
= 0;
296 env
->interrupt_injected
= -1;
297 env
->nmi_injected
= false;
299 env
->has_error_code
= false;
300 if (idtvec_info
& VMCS_IDT_VEC_VALID
) {
301 switch (idtvec_info
& VMCS_IDT_VEC_TYPE
) {
302 case VMCS_IDT_VEC_HWINTR
:
303 case VMCS_IDT_VEC_SWINTR
:
304 env
->interrupt_injected
= idtvec_info
& VMCS_IDT_VEC_VECNUM
;
306 case VMCS_IDT_VEC_NMI
:
307 env
->nmi_injected
= true;
309 case VMCS_IDT_VEC_HWEXCEPTION
:
310 case VMCS_IDT_VEC_SWEXCEPTION
:
311 env
->exception_nr
= idtvec_info
& VMCS_IDT_VEC_VECNUM
;
312 env
->exception_injected
= 1;
314 case VMCS_IDT_VEC_PRIV_SWEXCEPTION
:
318 if ((idtvec_info
& VMCS_IDT_VEC_TYPE
) == VMCS_IDT_VEC_SWEXCEPTION
||
319 (idtvec_info
& VMCS_IDT_VEC_TYPE
) == VMCS_IDT_VEC_SWINTR
) {
320 env
->ins_len
= ins_len
;
322 if (idtvec_info
& VMCS_IDT_VEC_ERRCODE_VALID
) {
323 env
->has_error_code
= true;
324 env
->error_code
= rvmcs(cpu
->hvf_fd
, VMCS_IDT_VECTORING_ERROR
);
327 if ((rvmcs(cpu
->hvf_fd
, VMCS_GUEST_INTERRUPTIBILITY
) &
328 VMCS_INTERRUPTIBILITY_NMI_BLOCKING
)) {
329 env
->hflags2
|= HF2_NMI_MASK
;
331 env
->hflags2
&= ~HF2_NMI_MASK
;
333 if (rvmcs(cpu
->hvf_fd
, VMCS_GUEST_INTERRUPTIBILITY
) &
334 (VMCS_INTERRUPTIBILITY_STI_BLOCKING
|
335 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING
)) {
336 env
->hflags
|= HF_INHIBIT_IRQ_MASK
;
338 env
->hflags
&= ~HF_INHIBIT_IRQ_MASK
;
342 static void hvf_cpu_x86_cpuid(CPUX86State
*env
, uint32_t index
, uint32_t count
,
343 uint32_t *eax
, uint32_t *ebx
,
344 uint32_t *ecx
, uint32_t *edx
)
347 * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
348 * leafs 0x40000001-0x4000000F are filled with zeros
349 * Provides vmware-cpuid-freq support to hvf
351 * Note: leaf 0x40000000 not exposes HVF,
352 * leaving hypervisor signature empty
355 if (index
< 0x40000000 || index
> 0x40000010 ||
356 !tsc_is_known(env
) || !apic_bus_freq_is_known(env
)) {
358 cpu_x86_cpuid(env
, index
, count
, eax
, ebx
, ecx
, edx
);
364 *eax
= 0x40000010; /* Max available cpuid leaf */
365 *ebx
= 0; /* Leave signature empty */
371 *ebx
= env
->apic_bus_freq
/ 1000; /* Hz to KHz */
384 int hvf_vcpu_exec(CPUState
*cpu
)
386 X86CPU
*x86_cpu
= X86_CPU(cpu
);
387 CPUX86State
*env
= &x86_cpu
->env
;
391 if (hvf_process_events(cpu
)) {
396 if (cpu
->vcpu_dirty
) {
397 hvf_put_registers(cpu
);
398 cpu
->vcpu_dirty
= false;
401 if (hvf_inject_interrupts(cpu
)) {
402 return EXCP_INTERRUPT
;
406 qemu_mutex_unlock_iothread();
407 if (!cpu_is_bsp(X86_CPU(cpu
)) && cpu
->halted
) {
408 qemu_mutex_lock_iothread();
412 hv_return_t r
= hv_vcpu_run(cpu
->hvf_fd
);
416 uint64_t exit_reason
= rvmcs(cpu
->hvf_fd
, VMCS_EXIT_REASON
);
417 uint64_t exit_qual
= rvmcs(cpu
->hvf_fd
, VMCS_EXIT_QUALIFICATION
);
418 uint32_t ins_len
= (uint32_t)rvmcs(cpu
->hvf_fd
,
419 VMCS_EXIT_INSTRUCTION_LENGTH
);
421 uint64_t idtvec_info
= rvmcs(cpu
->hvf_fd
, VMCS_IDT_VECTORING_INFO
);
423 hvf_store_events(cpu
, ins_len
, idtvec_info
);
424 rip
= rreg(cpu
->hvf_fd
, HV_X86_RIP
);
425 env
->eflags
= rreg(cpu
->hvf_fd
, HV_X86_RFLAGS
);
427 qemu_mutex_lock_iothread();
429 update_apic_tpr(cpu
);
433 switch (exit_reason
) {
434 case EXIT_REASON_HLT
: {
435 macvm_set_rip(cpu
, rip
+ ins_len
);
436 if (!((cpu
->interrupt_request
& CPU_INTERRUPT_HARD
) &&
437 (env
->eflags
& IF_MASK
))
438 && !(cpu
->interrupt_request
& CPU_INTERRUPT_NMI
) &&
439 !(idtvec_info
& VMCS_IDT_VEC_VALID
)) {
444 ret
= EXCP_INTERRUPT
;
447 case EXIT_REASON_MWAIT
: {
448 ret
= EXCP_INTERRUPT
;
451 /* Need to check if MMIO or unmapped fault */
452 case EXIT_REASON_EPT_FAULT
:
455 uint64_t gpa
= rvmcs(cpu
->hvf_fd
, VMCS_GUEST_PHYSICAL_ADDRESS
);
457 if (((idtvec_info
& VMCS_IDT_VEC_VALID
) == 0) &&
458 ((exit_qual
& EXIT_QUAL_NMIUDTI
) != 0)) {
459 vmx_set_nmi_blocking(cpu
);
462 slot
= hvf_find_overlap_slot(gpa
, 1);
464 if (ept_emulation_fault(slot
, gpa
, exit_qual
)) {
465 struct x86_decode decode
;
468 decode_instruction(env
, &decode
);
469 exec_instruction(env
, &decode
);
475 case EXIT_REASON_INOUT
:
477 uint32_t in
= (exit_qual
& 8) != 0;
478 uint32_t size
= (exit_qual
& 7) + 1;
479 uint32_t string
= (exit_qual
& 16) != 0;
480 uint32_t port
= exit_qual
>> 16;
481 /*uint32_t rep = (exit_qual & 0x20) != 0;*/
486 hvf_handle_io(env
, port
, &val
, 0, size
, 1);
489 } else if (size
== 2) {
491 } else if (size
== 4) {
492 RAX(env
) = (uint32_t)val
;
494 RAX(env
) = (uint64_t)val
;
499 } else if (!string
&& !in
) {
500 RAX(env
) = rreg(cpu
->hvf_fd
, HV_X86_RAX
);
501 hvf_handle_io(env
, port
, &RAX(env
), 1, size
, 1);
502 macvm_set_rip(cpu
, rip
+ ins_len
);
505 struct x86_decode decode
;
508 decode_instruction(env
, &decode
);
509 assert(ins_len
== decode
.len
);
510 exec_instruction(env
, &decode
);
515 case EXIT_REASON_CPUID
: {
516 uint32_t rax
= (uint32_t)rreg(cpu
->hvf_fd
, HV_X86_RAX
);
517 uint32_t rbx
= (uint32_t)rreg(cpu
->hvf_fd
, HV_X86_RBX
);
518 uint32_t rcx
= (uint32_t)rreg(cpu
->hvf_fd
, HV_X86_RCX
);
519 uint32_t rdx
= (uint32_t)rreg(cpu
->hvf_fd
, HV_X86_RDX
);
522 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
523 env
->cr
[4] = rvmcs(cpu
->hvf_fd
, VMCS_GUEST_CR4
);
525 hvf_cpu_x86_cpuid(env
, rax
, rcx
, &rax
, &rbx
, &rcx
, &rdx
);
527 wreg(cpu
->hvf_fd
, HV_X86_RAX
, rax
);
528 wreg(cpu
->hvf_fd
, HV_X86_RBX
, rbx
);
529 wreg(cpu
->hvf_fd
, HV_X86_RCX
, rcx
);
530 wreg(cpu
->hvf_fd
, HV_X86_RDX
, rdx
);
532 macvm_set_rip(cpu
, rip
+ ins_len
);
535 case EXIT_REASON_XSETBV
: {
536 X86CPU
*x86_cpu
= X86_CPU(cpu
);
537 CPUX86State
*env
= &x86_cpu
->env
;
538 uint32_t eax
= (uint32_t)rreg(cpu
->hvf_fd
, HV_X86_RAX
);
539 uint32_t ecx
= (uint32_t)rreg(cpu
->hvf_fd
, HV_X86_RCX
);
540 uint32_t edx
= (uint32_t)rreg(cpu
->hvf_fd
, HV_X86_RDX
);
543 macvm_set_rip(cpu
, rip
+ ins_len
);
546 env
->xcr0
= ((uint64_t)edx
<< 32) | eax
;
547 wreg(cpu
->hvf_fd
, HV_X86_XCR0
, env
->xcr0
| 1);
548 macvm_set_rip(cpu
, rip
+ ins_len
);
551 case EXIT_REASON_INTR_WINDOW
:
552 vmx_clear_int_window_exiting(cpu
);
553 ret
= EXCP_INTERRUPT
;
555 case EXIT_REASON_NMI_WINDOW
:
556 vmx_clear_nmi_window_exiting(cpu
);
557 ret
= EXCP_INTERRUPT
;
559 case EXIT_REASON_EXT_INTR
:
560 /* force exit and allow io handling */
561 ret
= EXCP_INTERRUPT
;
563 case EXIT_REASON_RDMSR
:
564 case EXIT_REASON_WRMSR
:
567 if (exit_reason
== EXIT_REASON_RDMSR
) {
576 case EXIT_REASON_CR_ACCESS
: {
582 reg
= (exit_qual
>> 8) & 15;
586 macvm_set_cr0(cpu
->hvf_fd
, RRX(env
, reg
));
590 macvm_set_cr4(cpu
->hvf_fd
, RRX(env
, reg
));
594 X86CPU
*x86_cpu
= X86_CPU(cpu
);
595 if (exit_qual
& 0x10) {
596 RRX(env
, reg
) = cpu_get_apic_tpr(x86_cpu
->apic_state
);
598 int tpr
= RRX(env
, reg
);
599 cpu_set_apic_tpr(x86_cpu
->apic_state
, tpr
);
600 ret
= EXCP_INTERRUPT
;
605 error_report("Unrecognized CR %d", cr
);
612 case EXIT_REASON_APIC_ACCESS
: { /* TODO */
613 struct x86_decode decode
;
616 decode_instruction(env
, &decode
);
617 exec_instruction(env
, &decode
);
621 case EXIT_REASON_TPR
: {
625 case EXIT_REASON_TASK_SWITCH
: {
626 uint64_t vinfo
= rvmcs(cpu
->hvf_fd
, VMCS_IDT_VECTORING_INFO
);
627 x68_segment_selector sel
= {.sel
= exit_qual
& 0xffff};
628 vmx_handle_task_switch(cpu
, sel
, (exit_qual
>> 30) & 0x3,
629 vinfo
& VMCS_INTR_VALID
, vinfo
& VECTORING_INFO_VECTOR_MASK
, vinfo
633 case EXIT_REASON_TRIPLE_FAULT
: {
634 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
635 ret
= EXCP_INTERRUPT
;
638 case EXIT_REASON_RDPMC
:
639 wreg(cpu
->hvf_fd
, HV_X86_RAX
, 0);
640 wreg(cpu
->hvf_fd
, HV_X86_RDX
, 0);
641 macvm_set_rip(cpu
, rip
+ ins_len
);
643 case VMX_REASON_VMCALL
:
644 env
->exception_nr
= EXCP0D_GPF
;
645 env
->exception_injected
= 1;
646 env
->has_error_code
= true;
650 error_report("%llx: unhandled exit %llx", rip
, exit_reason
);